[Resolved] Internet address hijack

This is the OTListIT. On my Computer I Have: Norman AV Norman Adaware Pro Norman Malware Cleaner Lavasoft Adaware Pro I need help in disabling these as I want to be sure that I am doing it properly. Thanks. ========== OTLISTIT ========== Process Explorer.EXE killed successfully! Process SYS32DLL.exe killed successfully! Service\Driver perfmons deleted successfully. File File not found not found. Service\Driver Print Service deleted successfully. File File not found not found. Service\Driver Remote Manager deleted successfully. File File not found not found. Service\Driver Indexingbox deleted successfully. File File not found not found. Service\Driver NETDown deleted successfully. File File not found not found. Service\Driver WindowsKernel deleted successfully. File File not found not found. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7C7EFE99-C71F-48b8-8CC8-BA506CA76A33}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7C7EFE99-C71F-48b8-8CC8-BA506CA76A33}\ not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\pp deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\sysldtray deleted successfully. Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\SYS32DLL deleted successfully. C:\WINDOWS\System32\SYS32DLL.exe moved successfully. Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableTaskMgr deleted successfully. Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableRegistryTools deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit:C:\WINDOWS\system32\pavuppad.exe deleted successfully. File move failed. C:\WINDOWS\system32\pavuppad.exe scheduled to be moved on reboot. LoadLibrary failed for C:\WINDOWS\System32\pfxzmtsmtspm.dll C:\WINDOWS\System32\pfxzmtsmtspm.dll NOT unregistered. C:\WINDOWS\System32\pfxzmtsmtspm.dll moved successfully. LoadLibrary failed for C:\WINDOWS\System32\sfxzmtforum.dll C:\WINDOWS\System32\sfxzmtforum.dll NOT unregistered. C:\WINDOWS\System32\sfxzmtforum.dll moved successfully. LoadLibrary failed for C:\WINDOWS\System32\pfxzmtymsg.dll C:\WINDOWS\System32\pfxzmtymsg.dll NOT unregistered. C:\WINDOWS\System32\pfxzmtymsg.dll moved successfully. LoadLibrary failed for C:\WINDOWS\System32\pfxzmticq.dll C:\WINDOWS\System32\pfxzmticq.dll NOT unregistered. C:\WINDOWS\System32\pfxzmticq.dll moved successfully. LoadLibrary failed for C:\WINDOWS\System32\pfxzmtgtal.dll C:\WINDOWS\System32\pfxzmtgtal.dll NOT unregistered. C:\WINDOWS\System32\pfxzmtgtal.dll moved successfully. LoadLibrary failed for C:\WINDOWS\System32\pfxzmtaim.dll C:\WINDOWS\System32\pfxzmtaim.dll NOT unregistered. C:\WINDOWS\System32\pfxzmtaim.dll moved successfully. LoadLibrary failed for C:\WINDOWS\System32\pfxzmtwbmail.dll C:\WINDOWS\System32\pfxzmtwbmail.dll NOT unregistered. C:\WINDOWS\System32\pfxzmtwbmail.dll moved successfully. LoadLibrary failed for C:\WINDOWS\System32\pfxzmtsmt.dll C:\WINDOWS\System32\pfxzmtsmt.dll NOT unregistered. C:\WINDOWS\System32\pfxzmtsmt.dll moved successfully. LoadLibrary failed for C:\WINDOWS\System32\pfxzmtzpurse.dll C:\WINDOWS\System32\pfxzmtzpurse.dll NOT unregistered. C:\WINDOWS\System32\pfxzmtzpurse.dll moved successfully. LoadLibrary failed for C:\WINDOWS\System32\pfxzmtrpurse.dll C:\WINDOWS\System32\pfxzmtrpurse.dll NOT unregistered. C:\WINDOWS\System32\pfxzmtrpurse.dll moved successfully. LoadLibrary failed for C:\WINDOWS\System32\pfxzmtfpurse.dll C:\WINDOWS\System32\pfxzmtfpurse.dll NOT unregistered. C:\WINDOWS\System32\pfxzmtfpurse.dll moved successfully. ========== SERVICES/DRIVERS ========== ========== REGISTRY ========== ========== FILES ========== File\Folder C:\WINDOWS\system32\SYS32DLL.exe not found. C:\WINDOWS\System32\CF20455.exe moved successfully. C:\WINDOWS\System32\CF19610.exe moved successfully. C:\WINDOWS\t55ft2692f44.dat moved successfully. C:\WINDOWS\9g2234wesdf3dfgjf23 moved successfully. C:\WINDOWS\System32\218538 moved successfully. Folder move failed. C:\WINDOWS\System32\bookls scheduled to be moved on reboot. C:\WINDOWS\internat.exe moved successfully. C:\WINDOWS\System32\inform.dat moved successfully. C:\WINDOWS\System32\pmx moved successfully. C:\WINDOWS\System32\mywebhit.ini moved successfully. C:\WINDOWS\imsins.BAK moved successfully. ========== COMMANDS ========== User's Temp folder emptied. User's Internet Explorer cache folder emptied. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\nvcbin.def.fa1b0d9b.tmp scheduled to be deleted on reboot. Local Service Temp folder emptied. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. Local Service Temporary Internet Files folder emptied. Network Service Temp folder emptied. Network Service Temporary Internet Files folder emptied. Windows Temp folder emptied. Java cache emptied. Temp folders emptied. Explorer started successfully OTListIt2 by OldTimer - Version 2.0.15.8 log created on 05172009_091909

Hi ADS,


Norman antivirus

-Right click the N-icon
-Open the Norman Configuration Editor.
-Select the Components icon.
-Select the Start tab.
-Uncheck the box for Internet Protection.
-Click Save

Ad-Aware Pro is the same steps as AD-AWARE AD-WATCH, so that should be Ok.

Norman Malware Cleaner is an on demand program, so it won't be a problem

Norman Adaware Pro, I don't use it but try this

Double click the Norman Ad-Aware icon on your desktop to launch the program, and check in these sections Ad-aware SE status or General settings

The only issue is my Lavasoft adaware. I do not have an icon in my system tray only on my desktop. When I open this up I do not have an Active and Automatic option. I ahve managed to turn the Adwatch live off. Will this do? Thanks again.

Hi ADS, That should be ok. Thanks

Hi ADS,

Open hijackthis, do a system scan only and checkmark these lines, if present

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\pavuppad.exe,


Close ALL other windows/browsers and click Fix Checked. Answer Yes if prompted. Close HJT.


We will use combofix again but run it differently.

Please follow all previous instructions regarding security programs.

Open a new Notepad session

• Click the Start button, click run
• in the run box type notepad
• click ok
• In the notepad, Click "Format" and be certain that Word Wrap is not checked.
  
• Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE

Do Not copy the word CODE

File::
C:\WINDOWS\system32\pavuppad.exe

DirLook::
c:\windows\system32\bookls

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2E1A9DE4-ADA0-4501-A46E-6633CDB01654}]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"EnableProfileQuota"=-

In the notepad

• Click File, Save as…, and set the Save in to your Desktop
• In the filename box, type (including quotation marks) as the filename: "CFScript.txt"
• Click save

Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown below.

This will start ComboFix again.Close all browser/windows first.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[external image: Posted Image]




Download and save to your desktop Malwarebytes Anti-Malware

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.


Please post back

• combofix log
• MBAM log
• new HJT log

How's the computer?
Thanks

Hi

It certainly looks a lot better now.

Let's see if combofix can remove that folder. We will use another CFScript

Please follow all previous instructions regarding security programs.

Open a new Notepad session

• Click the Start button, click run
• in the run box type notepad
• click ok
• In the notepad, Click "Format" and be certain that Word Wrap is not checked.
  
• Copy and paste all the text in the code box below into the Notepad. Do Not copy the word CODE

Do Not copy the word CODE

KillAll::

Folder::
c:\windows\system32\bookls

In the notepad

• Click File, Save as…, and set the Save in to your Desktop
• In the filename box, type (including quotation marks) as the filename: "CFScript.txt"
• Click save

Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown below.

This will start ComboFix again.Close all browser/windows first.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[external image: Posted Image]




Please download RootRepeal to your desktop

• Physically disconnect your machine from the internet as your system will be unprotected.
• Unzip it to it's own folder, close all other programs especially your security programs (anti-spyware, anti-virus, and firewall) and run RootRepeal.exe
• Click the Report tab at the bottom and then the Scan button.
• A box will pop up, check the boxes beside Drivers, Files, Processes SSDT and click OK.
• Another box will open, check the boxes beside all the drives, eg : C:\, then click OK.
• The scan will take a little while to run, so let it go unhindered.
• Once it is done, click the Save Report button, call it RepealScan and save the log to your desktop.
• Reconnect to the internet.
• Post the log here in your reply.

Next

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

• Double-click SystemLook.exe to run it.
• Copy the content of the following codebox into the main textfield:
  Do not copy the word CODE note the script starts with the :
  
  

  :regfind
  proquota.exe

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Please post back with

• combofix log
• RootRepeal log
• SystemLook log

Thanks

When I reboot after using ComboFix I get quite a few this will change your Registry notices. I am not sure whether to accept or block these requests. I am very cautious when it comes to changing the registry. What should I do? Thanks.

Hi ADS, These warning came after running combofix and combofix rebooted your system? They are okay to allow.

The Root Repeal Log ROOTREPEAL © AD, 2007-2008 ================================================== Scan Time: 2009/05/18 09:32 Program Version: Version 1.2.3.0 Windows Version: Windows XP SP3 ================================================== Drivers ——————- Name: catchme.sys Image Path: C:\DOCUME~1\ALLENS~1\LOCALS~1\Temp\catchme.sys Address: 0xF77B8000 Size: 31744 File Visible: No Status: - Name: Combo-Fix.sys Image Path: Combo-Fix.sys Address: 0xF7510000 Size: 60416 File Visible: No Status: - Name: dump_atapi.sys Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys Address: 0xF3838000 Size: 98304 File Visible: No Status: - Name: dump_WMILIB.SYS Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Address: 0xF79D6000 Size: 8192 File Visible: No Status: - Name: PROCEXP90.SYS Image Path: C:\WINDOWS\system32\Drivers\PROCEXP90.SYS Address: 0xF7A50000 Size: 6464 File Visible: No Status: - Name: rootrepeal.sys Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys Address: 0xB7E42000 Size: 45056 File Visible: No Status: - Hidden/Locked Files ——————- Path: C:\Program Files\SUPERMICRO\SDIII\xitami\logs\console.log Status: Allocation size mismatch (API: 344, Raw: 0) Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\32\560-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v32-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v560-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\01\10-{351497A7-6E40-3164-EBA3-CA9837145F7D}-v1-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v10-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\11\541-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v11-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v541-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\12\544-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v12-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v544-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\13\542-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v13-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v542-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\14\543-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v14-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v543-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\15\549-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v15-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v549-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\16\545-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v16-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v545-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\17\546-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v17-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v546-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\18\547-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v18-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v547-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\19\548-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v19-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v548-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\20\553-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v20-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v553-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\21\550-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v21-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v550-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\22\551-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v22-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v551-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\23\552-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v23-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v552-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\24\554-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v24-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v554-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\25\555-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v25-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v555-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\26\593-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v26-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v593-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\27\556-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v27-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v556-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\28\564-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v28-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v564-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\29\557-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v29-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v557-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\30\558-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v30-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v558-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\31\559-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v31-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v559-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\33\561-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v33-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v561-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\34\562-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v34-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v562-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\35\563-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v35-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v563-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\36\572-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v36-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v572-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\37\565-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v37-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v565-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\38\566-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v38-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v566-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\39\567-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v39-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v567-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\40\568-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v40-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v568-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\41\569-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v41-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v569-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\42\570-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v42-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v570-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\43\571-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v43-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v571-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\44\590-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v44-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v590-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\45\573-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v45-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v573-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\46\574-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v46-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v574-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\47\575-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v47-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v575-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\48\576-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v48-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v576-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\49\577-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v49-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v577-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\50\578-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v50-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v578-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\51\579-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v51-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v579-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\52\580-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v52-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v580-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\53\581-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v53-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v581-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\54\582-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v54-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v582-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\55\583-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v55-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v583-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\56\584-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v56-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v584-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\57\585-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v57-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v585-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\58\586-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v58-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v586-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\59\587-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v59-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v587-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\60\588-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v60-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v588-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\61\589-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v61-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v589-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\62\592-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v62-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v592-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Messenger\[removed]\SharingMetadata\[removed]\DFSR\Staging\CS{351497A7-6E40-3164-EBA3-CA9837145F7D}\63\538-{23C24B4A-9447-44D6-B724-48DD217D7B4B}-v63-{598E92ED-1A6B-4A60-A688-DD13862640FC}-v538-Downloaded.frx Status: Locked to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Silverlight\is\0xiguzad.nai\d105nl1a.ihf\1\s\5cgn4gembioxblnsomtczk513qzthc00ie5jfkem32xua5gn0faaahaa\f\LastLayout.bfcLayout:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 Status: Invisible to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Silverlight\is\0xiguzad.nai\d105nl1a.ihf\1\s\5cgn4gembioxblnsomtczk513qzthc00ie5jfkem32xua5gn0faaahaa\f\LastLayout.bfcLayout:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS Status: Invisible to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Silverlight\is\0xiguzad.nai\d105nl1a.ihf\1\s\5cgn4gembioxblnsomtczk513qzthc00ie5jfkem32xua5gn0faaahaa\f\LastLayout.bfcLayout:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS Status: Invisible to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Silverlight\is\0xiguzad.nai\d105nl1a.ihf\1\s\5cgn4gembioxblnsomtczk513qzthc00ie5jfkem32xua5gn0faaahaa\f\LastLayout.bfcLayout:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 Status: Invisible to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Silverlight\is\0xiguzad.nai\d105nl1a.ihf\1\s\5cgn4gembioxblnsomtczk513qzthc00ie5jfkem32xua5gn0faaahaa\f\LastLayout.bfcLayout:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS Status: Invisible to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Silverlight\is\0xiguzad.nai\d105nl1a.ihf\1\s\5cgn4gembioxblnsomtczk513qzthc00ie5jfkem32xua5gn0faaahaa\f\LastLayout.bfcLayout:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 Status: Invisible to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Silverlight\is\0xiguzad.nai\d105nl1a.ihf\1\s\5cgn4gembioxblnsomtczk513qzthc00ie5jfkem32xua5gn0faaahaa\f\LastLayout.bfcLayout:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS Status: Invisible to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Silverlight\is\0xiguzad.nai\d105nl1a.ihf\1\s\5cgn4gembioxblnsomtczk513qzthc00ie5jfkem32xua5gn0faaahaa\f\LastLayout.bfcLayout:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 Status: Invisible to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Silverlight\is\0xiguzad.nai\d105nl1a.ihf\1\s\5cgn4gembioxblnsomtczk513qzthc00ie5jfkem32xua5gn0faaahaa\f\LastLayout.bfcLayout:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS Status: Invisible to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Silverlight\is\0xiguzad.nai\d105nl1a.ihf\1\s\5cgn4gembioxblnsomtczk513qzthc00ie5jfkem32xua5gn0faaahaa\f\LastLayout.bfcLayout:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 Status: Invisible to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Silverlight\is\0xiguzad.nai\d105nl1a.ihf\1\s\5cgn4gembioxblnsomtczk513qzthc00ie5jfkem32xua5gn0faaahaa\f\LastLayout.bfcLayout:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS Status: Invisible to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Silverlight\is\0xiguzad.nai\d105nl1a.ihf\1\s\5cgn4gembioxblnsomtczk513qzthc00ie5jfkem32xua5gn0faaahaa\f\LastLayout.bfcLayout:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 Status: Invisible to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Silverlight\is\0xiguzad.nai\d105nl1a.ihf\1\s\5cgn4gembioxblnsomtczk513qzthc00ie5jfkem32xua5gn0faaahaa\f\LastLayout.bfcLayout:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS Status: Invisible to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Silverlight\is\0xiguzad.nai\d105nl1a.ihf\1\s\5cgn4gembioxblnsomtczk513qzthc00ie5jfkem32xua5gn0faaahaa\f\LastLayout.bfcLayout:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 Status: Invisible to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Silverlight\is\0xiguzad.nai\d105nl1a.ihf\1\s\5cgn4gembioxblnsomtczk513qzthc00ie5jfkem32xua5gn0faaahaa\f\LastLayout.bfcLayout:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS Status: Invisible to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Silverlight\is\0xiguzad.nai\d105nl1a.ihf\1\s\5cgn4gembioxblnsomtczk513qzthc00ie5jfkem32xua5gn0faaahaa\f\LastLayout.bfcLayout:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 Status: Invisible to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Silverlight\is\0xiguzad.nai\d105nl1a.ihf\1\s\5cgn4gembioxblnsomtczk513qzthc00ie5jfkem32xua5gn0faaahaa\f\LastLayout.bfcLayout:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS Status: Invisible to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Silverlight\is\0xiguzad.nai\d105nl1a.ihf\1\s\5cgn4gembioxblnsomtczk513qzthc00ie5jfkem32xua5gn0faaahaa\f\LastLayout.bfcLayout:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 Status: Invisible to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Silverlight\is\0xiguzad.nai\d105nl1a.ihf\1\s\5cgn4gembioxblnsomtczk513qzthc00ie5jfkem32xua5gn0faaahaa\f\LastLayout.bfcLayout:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS Status: Invisible to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Silverlight\is\0xiguzad.nai\d105nl1a.ihf\1\s\5cgn4gembioxblnsomtczk513qzthc00ie5jfkem32xua5gn0faaahaa\f\LastLayout.bfcLayout:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 Status: Invisible to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Silverlight\is\0xiguzad.nai\d105nl1a.ihf\1\s\5cgn4gembioxblnsomtczk513qzthc00ie5jfkem32xua5gn0faaahaa\f\LastLayout.bfcLayout:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS Status: Invisible to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Silverlight\is\0xiguzad.nai\d105nl1a.ihf\1\s\5cgn4gembioxblnsomtczk513qzthc00ie5jfkem32xua5gn0faaahaa\f\LastLayout.bfcLayout:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 Status: Invisible to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Silverlight\is\0xiguzad.nai\d105nl1a.ihf\1\s\5cgn4gembioxblnsomtczk513qzthc00ie5jfkem32xua5gn0faaahaa\f\LastLayout.bfcLayout:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS Status: Invisible to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Silverlight\is\0xiguzad.nai\d105nl1a.ihf\1\s\5cgn4gembioxblnsomtczk513qzthc00ie5jfkem32xua5gn0faaahaa\f\LastLayout.bfcLayout:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 Status: Invisible to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Silverlight\is\0xiguzad.nai\d105nl1a.ihf\1\s\5cgn4gembioxblnsomtczk513qzthc00ie5jfkem32xua5gn0faaahaa\f\LastLayout.bfcLayout:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS Status: Invisible to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Silverlight\is\0xiguzad.nai\d105nl1a.ihf\1\s\5cgn4gembioxblnsomtczk513qzthc00ie5jfkem32xua5gn0faaahaa\f\LastLayout.bfcLayout:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 Status: Invisible to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Silverlight\is\0xiguzad.nai\d105nl1a.ihf\1\s\5cgn4gembioxblnsomtczk513qzthc00ie5jfkem32xua5gn0faaahaa\f\LastLayout.bfcLayout:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS Status: Invisible to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Silverlight\is\0xiguzad.nai\d105nl1a.ihf\1\s\5cgn4gembioxblnsomtczk513qzthc00ie5jfkem32xua5gn0faaahaa\f\LastLayout.bfcLayout:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.rdc.1 Status: Invisible to the Windows API! Path: C:\Documents and Settings\Allen Sheena\Local Settings\Application Data\Microsoft\Silverlight\is\0xiguzad.nai\d105nl1a.ihf\1\s\5cgn4gembioxblnsomtczk513qzthc00ie5jfkem32xua5gn0faaahaa\f\LastLayout.bfcLayout:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS Status: Invisible to the WiSSDT ——————- #: 041 Function Name: NtCreateKey Status: Hooked by "Lbd.sys" at address 0xf74f087e #: 047 Function Name: NtCreateProcess Status: Hooked by "C:\Program Files\Norman\Ngs\Bin\nprosec.sys" at address 0xf75840d4 #: 048 Function Name: NtCreateProcessEx Status: Hooked by "C:\Program Files\Norman\Ngs\Bin\nprosec.sys" at address 0xf7584104 #: 053 Function Name: NtCreateThread Status: Hooked by "C:\Program Files\Norman\Ngs\Bin\nprosec.sys" at address 0xf75836fc #: 247 Function Name: NtSetValueKey Status: Hooked by "Lbd.sys" at address 0xf74f0bfe #: 257 Function Name: NtTerminateProcess Status: Hooked by "C:\Program Files\Norman\Ngs\Bin\nprosec.sys" at address 0xf7584488 #: 277 Function Name: NtWriteVirtualMemory Status: Hooked by "C:\Program Files\Norman\Ngs\Bin\nprosec.sys" at address 0xf7584134